# Prepare the ground

Gather the machine, the flows and the accounts before you start. This page can be passed on as it is to your network team.

## The machine

The collector is a small standalone service. A small dedicated virtual machine is enough.

- **System**: Linux with systemd (recommended) or macOS, amd64 or arm64.
- **Rights**: `sudo` for the installation only. The collector then runs under its own system account, without root rights.
- **Location**: where it can reach both Naoshift, on the Internet, and your hypervisors, on your network.

## The flows to open

All of them leave the collector. **No inbound flow**, no VPN.

| From the collector to | Port | Direction |
|---|---|---|
| Naoshift (`app.naoshift.io`) | HTTPS 443 | outbound, Internet |
| VMware vCenter | 443 | outbound, local network |
| Proxmox VE | 8006 | outbound, local network |
| Xen Orchestra | 443 | outbound, local network |
| Nutanix Prism Central | 9440 | outbound, local network |
| Microsoft Hyper-V, **every** node of the cluster | 5986 (WinRM HTTPS) | outbound, local network |
| OpenShift Virtualization, Superphenix (Kubernetes API) | 6443 | outbound, local network |
| HPE VM Essentials (VME Manager) | 443 | outbound, local network |

Your backups and arrays are read through the same collector, with their own ports: see [the last lesson of this path](/en/connect/backups-and-arrays).

## Proxy and TLS inspection

If the machine goes out through a proxy, or if TLS inspection sits on the path, flag it now. These are the two most frequent causes of a collector that cannot reach Naoshift.

## Read-only accounts

Plan one dedicated account per platform. Collection never needs write rights.

| Platform | Recommended account |
|---|---|
| VMware vSphere | A user with the **Read-only** role at the vCenter root, propagated to children |
| Proxmox VE | A user or API token with the **PVEAuditor** role on `/` |
| Xen Orchestra | An authentication token from an account with read access to the pools |
| Nutanix Prism Central | An account with the **Viewer** role |
| Microsoft Hyper-V | An account in *Hyper-V Administrators*, *Remote Management Users*, *Performance Monitor Users* and *Event Log Readers* on every node, with `Grant-ClusterAccess -ReadOnly`. Hyper-V has no read-only role: Naoshift only reads with this account |
| OpenShift Virtualization, Superphenix | A service account with the `naoshift-collector` ClusterRole, with no access to secrets |
| HPE VM Essentials | The API token of a read-only user |

### The firewall takes time to open

That is normal, and it is why this lesson comes first. Only create the install token once the flows are open: it expires after one hour.

### Hyper-V does not answer on port 5986

WinRM over HTTPS is not active by default. It must listen on **every** node of the cluster, and a port test from the collector machine must respond before you go further.

### How to test a flow from the collector machine

On Linux: `curl -kI https://vcenter.example.local` for a platform, `curl -I https://app.naoshift.io` for Naoshift. Any response, whatever its code, proves the flow is open.